More Than 100,000 WordPress Websites Reportedly Infected by Russian Malware

Google has already flagged 11,000 malicious domains -- though it is likely that many more than that have been compromised by a mysterious virus called 'SoakSoak.'

learn more about Geoff Weiss

By Geoff Weiss

Opinions expressed by Entrepreneur contributors are their own.

Updated on July 17 at 1:55 p.m. with comments from a WordPress spokesperson.

Over 100,000 WordPress sites have been infected by a Russian virus called SoakSoak, which loads an attack code onto webpages created through the uber-popular blogging platform, according to a report by Ars Technica.

Google has already flagged roughly 11,000 malicious domains -- though it is likely that many more than that have been compromised.

According to Gizmodo, more than 70 million total sites use WordPress as a content-management system -- from personal blogs to Time.com. However, only self-hosted sites that use WordPress have been affected by the malware -- meaning personal blogs are okay.

The aim of the hackers and the consequences of the virus -- whether to steal data or otherwise -- remain unclear.

Related: 5 Lessons Leaders Can Learn From the Sony Hacking Scandal

The malware infiltrated WordPress through a vulnerability in a slideshow plug-in called Slider Revolution. While Slider Revolution has since fixed the bug with updates -- it knew about the vulnerability earlier this fall, according to Gizmodo -- the older version of the plug-in is still bundled with many WordPress themes.

"The biggest issue is that the RevSlider plugin is a premium plugin," wrote Sucuri, an online security firm that was first to identify the infection. "It's not something everyone can easily upgrade and that in itself becomes a disaster for website owners."

Ars Technica notes that Sucuri also offers a free scanner here, which can determine which sites are actively compromised.

A WordPress spokesperson could neither confirm that 100,000 sites had been infected, nor that 70 million sites use the platform as a CMS.

"Automattic [WordPress.com's parent company] is taking action to protect sites from the vulnerability," the company said in a statement. "VaultPress, a backup and security product, has included protection from this vulnerability since it was first announced back in September."

Related: Get This: Sony Hack Reveals Company Stored Passwords in Folder Labeled 'Password'

Geoff Weiss

Former Staff Writer

Geoff Weiss is a former staff writer at Entrepreneur.com.

Related Topics

Editor's Pick

The Dark Side of Pay Transparency — And What to Do If You Find Out You're Being Underpaid
Thinking of a Career Change? Here Are 4 Steps You Can Take to Get There.
A Founder Who Bootstrapped Her Jewelry Business With Just $1,000 Now Sees 7-Figure Revenue Because She Knew Something About Her Customers Nobody Else Did
Everything You Need to Know About Franchise Law
Business News

A Mississippi News Anchor Is Under Fire for Quoting Snoop Dogg

WLBT's Barbara Bassett used the rapper's "fo shizzle" phrase during a live broadcast, causing the station to let her go.

Business Ideas

55 Small Business Ideas To Start Right Now

To start one of these home-based businesses, you don't need a lot of funding -- just energy, passion and the drive to succeed.

Marketing

Streaming TV Is the Future of Advertising — Without Breaking the Bank

Today's consumers expect personal, impactful ads. There's an advertising method that can get you there for half the price, making it the next frontier in digital advertising.

Growing a Business

Scaling Made Easy: How to Scale Your Business like a Fortune 500 Company

Once you have the night-vision skills of Fortune 500 restaurants, scaling becomes effortless. Here are 3 ways to scale, hidden in plain sight.